GitHub Advisoryadvisory · Maven

GHSA-cvvx-r33m-v7pq Improper Input Validation in Apache Struts

HIGH Published 2022-05-14 Modified 2025-10-13 Official page ↗
Aliases
CVE-2015-0899
Ecosystem
Maven
Packages
org.apache.struts:struts-core, struts:struts
Severity
High
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Weaknesses
CWE-20
Reviewed
2022-07-06

Affected packages

• Maven org.apache.struts:struts-core: >= 1.1, <= 1.3.10 (no fix yet) • Maven struts:struts: >= 1.1, <= 1.2.9 (no fix yet)

Description

The MultiPageValidator implementation in Apache Struts 1 1.1 through 1.3.10 allows remote attackers to bypass intended access restrictions via a modified page parameter.

Related

Alias · CVE (1)

  • CVE-2015-0899 The MultiPageValidator implementation in Apache Struts 1 1.1 through 1.3.10 allows remote attackers to bypass intended access restrictions… vulnerability

Weakness · CWE (1)

  • CWE-20 Improper Input Validation weakness

References